Personal Data Abuse in Marketing: Where to Report Calls and Texts

We, the team of Talha Aslan, wrote this as a public interest guide, not a pitch. Our goal is simple: to help you pick the right official door. This article is not legal advice, so please talk to a lawyer, a bar association referral service, or a consumer organization about your specific situation. Rules and procedures change, so check the current version on the official page.

What should you do first after an unwanted marketing message?

You do not need to reply or argue. A few quick steps protect your position, and they take only minutes. Follow them in this order:

1. Keep the message and take a screenshot that shows the sender, date, and time.
2. Avoid any link in the message, because it may lead to a fake page.
3. Note whether you recently gave your number or email to this company.
4. If the sender is a business you recognize, use its opt-out option and save proof.
5. Choose the channel from the table below.
6. Write down the date you acted, then watch for further contact.

If you suspect a scam, your path changes. In that case, read our guide on abuse of trust in online ads. If the target is a child, our guide on ads that exploit children fits better.

What does personal data abuse look like in marketing?

Not every annoying message breaks the law. Still, certain patterns come up again and again, and they are good starting points for a report. Consider these example scenarios:

• A sales call or text from a company you have never contacted.
• Marketing email that reaches you through a purchased or shared list.
• A number you gave for a quote, later used to sell unrelated products.
• A pre-checked consent box on a form that you never noticed.
• Messages that continue after you asked them to stop.
• Targeting based on your phone number or email without your clear agreement.

This list is not an accusation. For example, a company may in fact hold a valid record, and you may simply have forgotten the form. Therefore, your first job is to document what happened in date order, not to draw a legal conclusion.

Which channel fits which situation?

These channels do not replace each other, because each one answers a different question. In addition, a single incident can justify more than one report. Use this table for your first choice:

In short, the FTC and FCC handle the contact itself, while states and the company handle the data. Law enforcement steps in when there are signs of a crime.

How should you preserve evidence?

Agencies work from specifics. As a result, a tidy folder from day one makes every later step easier. Here is a simple order:

1. Screenshot each text with the sender number, date, and time visible.
2. Save your call log showing the caller ID and time of each call.
3. Keep the email itself, and copy its full header details into a file.
4. Save your opt-out request, any reply, and the date you sent it.
5. Keep copies of forms or pages where you think you gave your data.
6. Write a short timeline: what happened, when, and who answered.

Be careful with recording calls, because consent rules differ by state. A note written right after the call is often safer, so check with a lawyer before recording. Also, never try to get into a company's system or someone else's account while you look for proof.

How does the National Do Not Call Registry help?

The FTC Do Not Call FAQ explains the basics. You can register at DoNotCall.gov for free, or call 1-888-382-1222 (TTY 1-866-290-4236) from the phone you want to register. Both home and cell numbers qualify, although business lines do not.

Registration does not expire. Your number should appear the next day, yet calls can take up to 31 days to stop. For that reason, a call on day two is not yet a useful complaint. However, the Registry will not stop scammers, because they ignore it anyway.

Some calls remain allowed, including political calls, charitable calls, debt collection, purely informational calls, and surveys, as long as they carry no sales pitch. Also, a company may call if you recently did business with it or gave written permission. If you ask that company to stop, it must stop. Under FCC rules at 47 CFR 64.1200, a do-not-call request to a seller must be honored for five years.

How do you report unwanted calls to the FTC?

Use the report form at DoNotCall.gov if you did not lose money. If you lost money, or you know something about the caller, use ReportFraud.ftc.gov instead. Next, enter the details the FTC asks for:

• The number that received the call.
• The number on your caller ID, even if you think it was faked.
• Any number you were told to call back.
• The date and time of the call, if you can provide them.

Set your expectations correctly. The FTC receives millions of reports and says it cannot respond to each one. Instead, reports feed investigations and help carriers build call blocking tools. So a report rarely brings a personal answer, yet it still matters. In practice, a clear and factual entry is more useful than a long complaint. For example, "I never gave this company my number" tells them more than "this is harassment."

How do you report spam text messages?

The FTC guide to spam texts lists three practical routes. You can use one, two, or all of them:

1. Copy the message and forward it to 7726 (SPAM), so your carrier can spot and block similar messages.
2. Use the report junk or spam option in your messaging app.
3. File a report at ReportFraud.ftc.gov and paste the text into the comments field.

Do not click links, and do not share personal or financial details. If a message might be real, contact the company using a number or website you already trust. That way you avoid the contact details inside the message, which may be fake.

Also, a text from a real brand may give you a stop option. FCC rules treat replies such as "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" as reasonable ways to revoke consent for covered messages. However, if the text looks suspicious, skip the reply and use the report channels above.

What does the FCC do with calls and texts?

The Federal Communications Commission enforces rules under the Telephone Consumer Protection Act, known as the TCPA. You can file a complaint at consumercomplaints.fcc.gov. Choose the phone form and the unwanted calls or texts issue. Then include the number dialed, the caller ID, the date and time, and whether the line is wireless.

The FCC explains that it does not resolve individual complaints of this type. Rather, complaints guide its policy and possible enforcement, and it may share them with other agencies. So treat this as a signal to regulators, not a personal remedy.

The FCC rule text matters here. Under 47 CFR 64.1200, telemarketing robocalls and robotexts generally need prior express written consent. Telephone solicitations to residential numbers cannot come before 8 a.m. or after 9 p.m. local time. Finally, you can revoke consent by any reasonable means, and callers must honor it within ten business days at most. Whether you have a private claim is a question for a lawyer.

What does CAN-SPAM require from marketing email?

The FTC CAN-SPAM guide covers commercial email under 16 CFR Part 316. Its main requirements are practical:

• Sender and routing information must be accurate.
• Subject lines cannot be deceptive.
• The message must disclose that it is an advertisement.
• It must include a valid postal address.
• It must offer a clear way to opt out.
• Opt-outs must be honored within 10 business days.

After you opt out, the sender cannot sell or transfer your address, apart from a company hired to help it comply. Also, a business cannot contract away its responsibility for email sent on its behalf. Note that transactional messages, such as a receipt, are exempt from most provisions.

In practice, use the unsubscribe link only for senders you recognize. For an unknown or suspicious sender, mark the message as spam and report it instead. Then keep a copy, because you may need it later.

How do state privacy rights work?

This is where the picture varies. Some states give residents specific rights over personal data, while others offer less. Therefore, start with your own state. The USA.gov directory of state consumer offices lists an office for every state, the District of Columbia, and several territories.

California is a useful example, not a national rule. Its official privacy rights page lists the rights to know, delete, opt out of sale and sharing, correct, and limit use of sensitive data. It also offers a complaint section.

Other states may use different names, thresholds, and deadlines. So check your attorney general's or consumer office's website for the current rules. Federal agencies do not replace this step, because they usually address the contact, not your data file.

How do you write a data request to a company?

Put your request in writing, and keep it short. Send it to the privacy contact in the company's privacy policy, if it has one. Here is a sample structure you can adapt with your own details:

"To the privacy team: On [date], I received a marketing [call, text, or email] from [company] at [number or address]. Please tell me where you obtained this contact information and what record of my consent you hold. Please also stop marketing to me, and add this number to your do-not-call list. If my state's law gives me these rights, please also delete my personal information and tell me who received it. Please confirm in writing. [Your name and preferred reply address]"

Share only the information needed to find your record, because a company does not need your Social Security number for this. Also avoid threats and insults. A calm letter can become an attachment to your later complaint. Finally, note the date you sent it, then follow up if you hear nothing.

Is a purchased list personal data abuse?

Each case depends on its facts, so a purchased list is not automatically illegal for every channel. That said, purchased data does not create consent. Under 47 CFR 64.1200, prior express written consent is an agreement bearing the signature of the person called. It must clearly authorize that seller to deliver telemarketing messages to that number.

The FTC guide to the Telemarketing Sales Rule points the same way. Consent must be in writing, include the number, and carry the consumer's signature. An established relationship also has limits: 18 months after a purchase, and three months after an inquiry. It covers live calls, not robocalls.

Consider one example scenario. You filled out a quote form, and unrelated product texts then started. Ask the sender a direct question: which company, which form, and which disclosure? If it cannot answer, include that fact in your complaint. For the marketer's side of consent, see our guide on getting consent for marketing emails and texts.

Do pre-checked boxes and dark patterns count as consent?

For telemarketing permission, the FTC guide is direct: the consumer must opt in affirmatively, and pre-checked boxes do not count. In addition, the FCC definition of written consent requires a clear and conspicuous disclosure. It also says that signing cannot be a condition of purchase.

The FTC staff report on dark patterns takes a similar line. It says companies should obtain unambiguously affirmative consent and be able to verify it. Dark patterns include hidden boxes, confusing wording, or a sign-up flow that makes refusal hard to find.

So what can you do as a user? First, screenshot the form, including its default state. Second, note the date and the page address. Then ask the company for a copy of its consent record and report what you found. Leave the final legal judgment to the agency or a lawyer.

What if your data was exposed in a breach?

A breach calls for a different checklist, because the risk goes beyond marketing. The FTC points people to IdentityTheft.gov, or 1-877-438-4338, for steps based on the type of data exposed. Common actions include:

1. Change the exposed password, and any other account that reused it.
2. Contact your bank or card issuer if payment data was exposed.
3. Check your free credit reports if your Social Security number was exposed.
4. Consider a credit freeze, which makes new fraud accounts less likely.
5. Report any misuse at IdentityTheft.gov for a recovery plan.

Next, watch for targeted messages, since breached data often feeds them. The FBI's Internet Crime Complaint Center at IC3 also accepts complaints. It asks filers to use the words "data breach" in the description. Be aware that IC3 warns about scammers who impersonate it, and it says it does not work with outside firms to recover funds.

What if someone threatens to expose your data?

The short answer is this: do not pay, and go to the police. Paying rarely ends a threat, and it can invite further demands. You also do not need to handle it alone.

1. Save every threatening message without deleting anything.
2. Stop negotiating with the sender, and do not threaten back.
3. Change your passwords, then turn on two-step verification.
4. Call your bank directly if payment data may be at risk.
5. Report to local police, and file a complaint at IC3.

If private images or sensitive content are involved, please remember that you did nothing wrong by asking for help. A lawyer or a bar referral service can explain your options. Above all, move the conversation to an official channel and leave direct contact behind.

What should you avoid doing?

Being right does not make every response safe. In fact, some reactions can create new problems for you. Please avoid the following:

• Publishing an employee's name, phone number, or address online.
• Running your own investigation under a fake customer identity.
• Trying to log in to someone else's account, panel, or CRM.
• Calling the sender to threaten them, or sending threats back.
• Paying strangers who promise to remove you from every list.
• Filing a report with fake documents or exaggerated claims.

Blocking and platform reporting are still fine, because they do not hurt your case. For instance, a messaging app's report spam option or your email provider's spam button adds a layer of protection. However, they do not replace an official report.

How does targeted advertising fit into personal data abuse?

Targeting is harder to see from the outside. Seeing an ad does not prove misuse, so be careful about jumping to conclusions. Still, ad platforms generally offer a section explaining why you see an ad, along with ad preferences. Check the platform's current help pages to find it.

Consider an example scenario. You gave one company your email, and you then started seeing its ads tied to that address. In that case, ask the company whether it used your data for ad targeting, and who received it. If your state gives you rights to know or opt out of sharing, cite them.

Marketers should also understand this side. Our guide on Customer Match requirements and consent covers what to check before uploading a list.

How can a brand prevent personal data abuse?

This guide is not only for people filing reports. As a marketing team, we see that the common risk comes less from bad intent and more from messy processes. Here are the basics we recommend:

• Collect consent separately by purpose, and do not bundle it with sign-up.
• Leave boxes unchecked, so the person acts on their own.
• Record the date, source, and wording version for each consent.
• Avoid buying lists, and question partner or lead lists the same way.
• Route every opt-out and deletion request to one tracked place.
• Scrub call lists against the Registry and your internal do-not-call list.

Sending hygiene also matters, and we cover that in our email deliverability guide. Form design plays a role too, as our lead form design article explains. If you market abroad, rules differ by country; for Turkey, see our note for foreign brands. For legal texts, work with your own counsel.

What are the limits of this guide?

Everything here is general information, not legal advice. Federal rules, state laws, and agency practice can change over time. Therefore, check each deadline and procedure on the official page before you act. We also cannot promise any outcome, because the agency or court decides.

For your specific situation, consider a lawyer, your state bar's referral service, or your state consumer office. For example, if you are thinking about a lawsuit, a lawyer can review your evidence and tell you which deadlines apply. In short, save your proof, choose the right channel, and write calmly and factually.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.